build(deps): roll tar forward to 7.5.21

[thefounderluke]

Pull Request Checklist

Please ensure that your PR meets the following requirements:

• I have read the CONTRIBUTING guide.
• I have updated the documentation (if applicable). — N/A, dependency bump
• My code follows the style guidelines of this project.
• I have performed a self-review of my own code.
• I have added tests that prove my fix is effective or that my feature works. — N/A, lockfile/pin bump
• New and existing unit tests pass locally with my changes. — no test suite in the touched examples; verification notes below

Description

Rolls tar forward to 7.5.21 (latest), per #475:

• apps/livekit-moss-vercel/agent-react/pnpm-lock.yaml: bumps the locked transitive tar 7.5.13 → 7.5.21 (pulled in via @tailwindcss/oxide, whose ^7.4.3 range allows it). Lockfile-only; no manifest changes.
• moss-live-labs/examples/image-search/setup-js/package.json: raises the onnxruntime-node override pin ^7.5.13 → ^7.5.21 to match. Note: this override currently has no effect on the resolved tree (onnxruntime-node is not in this example's current dependency graph), so its lockfile is unchanged.

How verified:

• pnpm install (pnpm 9.15.9, matching the app's packageManager pin) completes cleanly against the updated lockfile.
• I attempted pnpm build of agent-react for full verification, but it fails identically on unmodified main in my environment (Windows; module-resolution errors unrelated to this change) — so no build regression is attributable to this change, but flagging honestly that I could not build-verify locally.

Fixes #475

[github-actions]

Codex review

No issues found.